论文标题
Netsentry：一种深度学习方法，用于检测初期的大规模网络攻击
NetSentry: A Deep Learning Approach to Detecting Incipient Large-scale Network Attacks
论文作者
论文摘要
机器学习（ML）技术被越来越多地用于应对不断发展的高调网络攻击，包括DDOS，僵尸网络和勒索软件，因为它们独特地提取了隐藏在数据流中的复杂模式的能力。但是，这些方法通常通过在同一环境中收集的数据进行常规验证，并且在我们发现的情况下部署在不同的网络拓扑和/或应用于以前看不见的流量时，它们的性能降低。这表明恶意/良性行为在很大程度上是从表面上学习的，基于ML的网络入侵检测系统（NIDS）需要重新审视，以便在实践中有效。在本文中，我们深入研究了大规模网络攻击的机制，以考虑如何以原则性的方式使用ML进行网络入侵检测（NID）。我们透露，尽管网络攻击在有效载荷，矢量和目标方面有很大差异，但它们的早期阶段对于成功的攻击结果至关重要，但具有许多相似之处并具有重要的时间相关性。因此，我们将NID视为一项时间敏感的任务，并提出了NetSentry，这也许是基于双向不对称LSTM（BI-ALSTM）建立的第一个同类NID，这是顺序神经模型的原始集合，用于检测网络威胁在传播之前。我们使用两个实用数据集进行了交叉评估NetSentry，一个在一个方面进行培训并进行测试，并证明了F1得分的增长超过了最新的33％，以及检测XSS和Web bruteforce等攻击的速度最高3倍。此外，我们提出了一种新型的数据增强技术，该技术提高了广泛的监督深度学习算法的概括能力，从而导致F1得分的平均得分提高到35％以上。
Machine Learning (ML) techniques are increasingly adopted to tackle ever-evolving high-profile network attacks, including DDoS, botnet, and ransomware, due to their unique ability to extract complex patterns hidden in data streams. These approaches are however routinely validated with data collected in the same environment, and their performance degrades when deployed in different network topologies and/or applied on previously unseen traffic, as we uncover. This suggests malicious/benign behaviors are largely learned superficially and ML-based Network Intrusion Detection System (NIDS) need revisiting, to be effective in practice. In this paper we dive into the mechanics of large-scale network attacks, with a view to understanding how to use ML for Network Intrusion Detection (NID) in a principled way. We reveal that, although cyberattacks vary significantly in terms of payloads, vectors and targets, their early stages, which are critical to successful attack outcomes, share many similarities and exhibit important temporal correlations. Therefore, we treat NID as a time-sensitive task and propose NetSentry, perhaps the first of its kind NIDS that builds on Bidirectional Asymmetric LSTM (Bi-ALSTM), an original ensemble of sequential neural models, to detect network threats before they spread. We cross-evaluate NetSentry using two practical datasets, training on one and testing on the other, and demonstrate F1 score gains above 33% over the state-of-the-art, as well as up to 3 times higher rates of detecting attacks such as XSS and web bruteforce. Further, we put forward a novel data augmentation technique that boosts the generalization abilities of a broad range of supervised deep learning algorithms, leading to average F1 score gains above 35%.
